This vulnerability concerns the use of hard-coded cryptographic keys in the PropertyGuru AgentNet Singapore App on Android (versions 23.7.0 through 23.7.10). The keys are embedded in the BuildConfig.java file, which may allow an attacker with local access to manipulate these keys. The weakness is identified by CVE-2026-5457 and has a CVSS 4.8 (medium) score, indicating limited attack vector and complexity. The vendor has not issued any advisory or patch, and the exploit code is publicly available.

The use of hard-coded cryptographic keys can lead to compromised confidentiality or integrity of data protected by these keys if an attacker gains local access to the device. However, the attack requires local privileges and does not involve user interaction, limiting the scope and ease of exploitation. No evidence of widespread exploitation is reported. The medium CVSS score reflects these constraints.

No official patch or remediation is currently available from the vendor. Since the vulnerability requires local access, restricting physical and local access to devices running affected versions can reduce risk. Monitor for vendor advisories for any future updates or patches. Avoid using affected versions where possible until a fix is released.